1. Field of the Invention
The present invention relates generally to computer network security, and more particularly, to a method, article, and system for defeating the ‘man in the middle’ computer hacking technique.
2. Description of the Related Art
The growth of Internet commerce, and the widespread use of the Web to carryout financial transactions have lead to the introduction of Internet crime and computer network hacking. Hacking refers to attempts to defeat or exploit the security capabilities of a computer system.
One of the most difficult computer security problems to deal with involves hackers using a ‘man in the middle’ scheme. In the ‘man in the middle’ scheme, a hacker is able to convince an unsuspecting user that the hacker's web site is a legitimate web site for carrying out a transaction, such as an online banking web site, etc. The hacker's illegitimate web site logs on to a real transaction web site (bank web site, etc.) and relays all of the information requested by the transaction web site that is used to authenticate the user to the site, back to the user that is being deceived. For example, in the event a bank requests a userid and password, the request is forwarded to the unsuspecting user, by the ‘man in the middle’, and when the information is supplied, the hacker uses the information to gain access to the bank web site in place of the legitimate user.
The hacker sends intercepted transactions that are requested by the legitimate user to the bank's web site, and the bank's transaction responses are also intercepted by the hacker and sent back to the user. The intercepted transactions are transparent to both the legitimate user and the authorized web site, resulting in a transaction that the user believes was carried out while directly being logged onto the bank's web site. In general, the intercepted transaction will be successful from the standpoint of the legitimate user; however, the hacker has now also gained access to the userid and password of the legitimate user. The hacker is now free to logon to the bank web site as the legitimate user and withdraw money from the user's account.
There are several methods employed by hackers to place themselves between (man in the middle) legitimate users and their intended web sites. One method, widely known as pfishing, involves the sending of emails to a user and convincing the user to select a uniform resource locator (URL) contained in the email. The URL contained in the phishing email subsequently sends the user to the hacker's web site, which appears as an exact duplicate of the intended web site. Additional methods utilized by hackers include a phony web site URL on a pop-up window, corrupting a user host file so that it changes a bank URL to the URL of the hacker's phony web site, and setting up a rogue WiFi access point, which collects and retains input of sensitive account information. Related to methods for the man in the middle hacker scheme, but much more destructive, is the situation in which a hacker gains access to a Domain Name Server (DNS). DNSs exist to translate a URL, which is an alphanumeric alias for an Internet Protocol (IP) address, to the actual numeric IP address, so that a communication connection to the IP address may be enabled.
Finally, another known method employed by hackers is Keylogging. Keylogging is a technological process of monitoring computer activity by recording, transmitting, and examining the characters typed on a computer keyboard. Employers monitoring employee productivity, typically involving clerical tasks sometimes use the keylogging technique. Other, more nefarious implementations of keylogging programs involve espionage, such as those embodied in spyware programs. These programs attempt to gather confidential information, such as a text string including an account name and password, and particularly a text string of keyboard strokes following input of a particular web site address. For example, a mouse click on a web browser icon displays the configured home page. A keyboard is used to enter a secure banking web site universal resource locator (URL) in the address input box. Following that, an account number and password are keyed in to the respective input fields. A malicious spyware program records the keystrokes entered on the keyboard, and that sequence of keystrokes is sent to an unknown third party for possible fraudulent use.
Keylogging programs, once installed and activated on a computer system, are extremely difficult to detect. Commercial and freeware spyware detection programs are available, but they are only useful against identified threats listed in the anti-spyware definitions file. However, standard anti-spyware detection programs may not identify new and more recent variations of spyware keylogger programs.
Keylogging programs generally work on the principle of detecting basic input/output system (BIOS) signals sent from what is assumed to be a standard keyboard layout (e.g., “QWERTY”, “DVORAK”, or other standard international keyboard layouts). Windows Vista and other popular operating systems and application software enable “re-mapping” of a computer keyboard. While this technique will thwart keyloggers, it is largely unused by the majority of computer users because the remapped keyboard departs from what is traditionally coordinated with the “muscle memory” of touch typists familiar with standard keyboard layouts. Other solutions to thwart keylogging involve displaying a keyboard on a monitor, from which input letters are selected with the mouse to enter the alphabetic and numeric characters in the input fields into the web form area that is used to contain the password. A variation of this method is to copy and paste the confidential information from a file. However, such approaches carry the risk of being defeated by hackers through the use of capturing and transmitting screen shots of completed forms, which are then analyzed for the confidential information.